facebookarchive/liblogfaf

Rsyslog listening to multiple ports!

Closed this issue · 3 comments

bkannadassan commented

Hi All,

I have 4 different process logging and I am making my rsyslog listen to multiple ports. I would like to know if all write to the same port / if each write to different port do we see any performance difference ?.

rgds
Balaji Kamal Kannadassan

pallotron commented

how do you processes do the logging? do they use the syslog syscall or are they sending syslog messages directly without passing from the syslog system call?

this project is designed to intercept the syslog syscalls (via LD_PRELOAD) and send messages to one a IP:PORT tuple based on LIBLOGFAF_SERVER_* environment variable.

bkannadassan commented

Its like this
ProcessA -> sending via liblogfaf to 514
ProcessB -> sending via liblogfaf to 515
ProcessC -> sending via liblogfaf to 516
ProcessD -> sending via liblogfaf to 517

rsyslog listening to 514/515/516/517 and write to a single file.

Now is there any difference in performance if all Process A/B/C/D send to same port 514 / different port as above ?
rgds
-Balaji

pallotron commented

are the rsyslog servers separate process each binding to a separate port? or the same process binding to multiple ports?

In the end I have no magic sphere to tell you what will be more performant :) only experiments/benchmarks can tell you that :)

I suggest you instrument the system and collect your data with either synthetic or real traffic under the two configurations (single ports vs multiple ports) and take informed decisions :)

  • 😄1